So @36ebea is not the object's address, but its hashcode which (being based only on username) remains the same for different instances where only the version differs.

You might want to use System.identityHashCode() to get a hashcode derived from the object's address (it basically returs what you would get from calling hashCode() if you didn't override the one inherited from Object).